Subject: RE: [mobile-ip] LMM requirements: security issue

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 4 Sep 2002 14:17:35 +0200

James, 

catching up with email..

  > Extended mode has a problem, because it removes the HA 
  > tunnel. So far, I've seen
  > no suggestion from anybody about how to solve the problem. 
  > If we can't figure
  > out how to solve it, I think we should remove extended mode 
  > from the spec.

=> This is not the security problem in Extended mode. In 
fact we never had this problem until RR was added to the 
spec. The problem is using a single address for multiple 
nodes (like an FA). I think you can simply solve it by
having 1:1 mapping of RCoA to LCoA. You can still decapsulate
packets at the MAP though, this is a separate issue and 
does not cause problems, unless AH tunnel mode is used, in which
cases you can't decapsulate the packet in the MAP. 

  > There is, of course, an issue of whether the MN can trust a 
  > MAP to act as a
  > routing proxy for it. Some kind of authentication procedure 
  > is required,
  > otherwise, anybody could advertise as a MAP. Since the MAP 
  > is not part of the
  > routing fabric, the authentication procedure must be 
  > separate from the
  > authentication between the MN and its access router, though 
  > perhaps related.

=> I don't think there is an issue with a MN trusting 
a MAP to route its packets. Or to phrase this better, I
think that mobile nodes implicitly trust routers in the 
visited network to forward their traffic, if they don't
then they would have to choose another network.

The issue here is to authenticate the agent, which 
can be done with IPsec. I'm looking at RR as an option
also (a more plug n play option), any comments are welcome. 

Of course CGAs would do the job almost perfectly here,
but we should really add non-standard stuff in future 
when it becomes standard.

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Wed, 4 Sep 2002 09:12:47 -0700

Hesham,

> cases you can't decapsulate the packet in the MAP. 

So what happens if AH tunnel mode is used?

> then they would have to choose another network.

Are you proposing that the MAP participate in the routing security association?

> when it becomes standard.

OK, any option that allows authentiation of the agent is fine.

            jak

---

From: Greg Daley <[email-masked]>
Date: Thu, 05 Sep 2002 10:12:37 +1000

[about HMIPv6 Extended Mode]
> So what happens if AH tunnel mode is used?

In the situiation where AH and ESP are being used (say
from the HA to the MN for binding signalling), it would
be necessary to add a routing header outside the ESP or AH
header to gauarantee that the XMAP (Extended MAP) can
understand the packet.

Note that this requirement is on the HA, which is
essentially unaware that an LMM is being used, and so is
a new requirement in MIPv6 (or a showstopper for current
extended mode ???).

There already is a requirement to tunnel site-local
packets with a routing header for extended mode.

Greg Daley

---

From: "James Kempf" <[email-masked]>
Date: Wed, 4 Sep 2002 18:28:04 -0700

Greg,

> packets with a routing header for extended mode.

The other alternative is for the MAP to not decapsulate, as Hesham suggested.
This requires some way for the MAP to know that an AH tunnel is in place.

            jak

---

From: Greg Daley <[email-masked]>
Date: Thu, 05 Sep 2002 12:21:18 +1000

Hi James,

In extended Mode with ESP, this will not work,
since it needs to see the ESP payload (the
encapsulated IPv6 packet), which is encrypted.

The encapsulating IPv6 packet only contains
the RCoA, which as the MAP's address, is not unique,
and cannot be used to match any MN's Binding.